usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-63960
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:14 UTC
Updated2026-07-20 07:16:41 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() wcove_read_rx_buffer() copies the PD RX FIFO into the caller's struct pd_message with for (i = 0; i < USBC_RXINFO_RXBYTES(info); i++) regmap_read(wcove->regmap, USBC_RX_DATA + i, msg + i); which has two problems: USBC_RXINFO_RXBYTES() is a 5-bit field (max 31) while struct pd_message is 30 bytes (__le16 header + __le32 payload[PD_MAX_PAYLOAD], packed). The byte count latched in RXINFO is the number of bytes the port partner put on the wire, so a malicious partner that transmits a 31-byte frame can drive the loop one byte past the destination if the WCOVE BMC receiver does not enforce the PD object-count limit in hardware. The existing FIXME flagged this as unverified. Independently, regmap_read() takes an unsigned int * and stores a full unsigned int at the destination. Passing the byte pointer msg + i means each iteration writes four bytes; the high three are zero (val_bits is 8) and are normally overwritten by the next iteration, but the final iteration's high bytes are not. With RXBYTES == 30 the i == 29 iteration already writes three zero bytes past msg, which sits on the IRQ thread's stack in wcove_typec_irq(). Clamp the loop to sizeof(struct pd_message) and read each register into a local before storing only its low byte, so the copy can never exceed the destination regardless of what RXINFO reports.

Risk And Classification

EPSS: 0.002100000 probability, percentile 0.113640000 (date 2026-07-20)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 3e632098d0521257ea965bbd6fde807d9bee5c8a git Not specified
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 f2a1edc0bd142edabc6c85d88713f2bc178dd317 git Not specified
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22 git Not specified
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 5cd0e7ac4eefbdb330f8c72694fe74e63df65552 git Not specified
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 d0e4b8b3c6b7607a16932556eaaca5d5cf69f192 git Not specified
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 e94933dc41b87503bf585c8c6d53d740620eceb9 git Not specified
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 3f9d50c8b02b4af0646aa892465080f9061fc89c git Not specified
CNA Linux Linux affected 3c4fb9f169214290ec9a943907321e6265b36f65 4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa git Not specified
CNA Linux Linux affected 4.15 Not specified
CNA Linux Linux unaffected 4.15 semver Not specified
CNA Linux Linux unaffected 5.10.259 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.93 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.35 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.12 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/e94933dc41b87503bf585c8c6d53d740620eceb9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3e632098d0521257ea965bbd6fde807d9bee5c8a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d0e4b8b3c6b7607a16932556eaaca5d5cf69f192 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3f9d50c8b02b4af0646aa892465080f9061fc89c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f2a1edc0bd142edabc6c85d88713f2bc178dd317 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5cd0e7ac4eefbdb330f8c72694fe74e63df65552 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report